CVE-2026-15577

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Grafana via Status Subresource Manipulation

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Grafana Labs

Description

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-15577

EUVD

EUVD-2026-98904

Affected Vendors & Products

Vendor	Product	Version / Range
Grafana	Grafana	Enterprise 12.4.0
Grafana	Grafana	Enterprise 13.0.0
Grafana	Grafana	Enterprise 13.1.0
Grafana	Grafana	Enterprise 13.2.0
Grafana	Grafana	OSS 12.4.0
Grafana	Grafana	OSS 13.0.0
Grafana	Grafana	OSS 13.1.0
Grafana	Grafana	OSS 13.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability allows a user or service account with read-only access to Git Sync (provisioning) connections to modify a connection's configuration through its status subresource due to incorrect authorization. The affected API was only available in Grafana 12.4 when the experimental provisioning feature toggle was enabled.

Detection Guidance

Check if Grafana 12.4 is running with the experimental provisioning feature toggle enabled. Review logs for unauthorized modifications to Git Sync connection configurations via the status subresource. Use Grafana API endpoints to inspect connection status changes.

Impact Analysis

The vulnerability allows unauthorized modification of Git Sync configurations, which could lead to misconfigured connections or disruptions in data synchronization. It does not affect data confidentiality or availability but may impact the integrity of Git Sync setups.

Compliance Impact

This vulnerability allows unauthorized modification of Git Sync configurations by read-only users, which could lead to improper data handling or exposure. Such unauthorized changes may violate compliance requirements for data integrity and access controls in standards like GDPR and HIPAA.

Mitigation Strategies

Upgrade Grafana to a patched version (12.4.13, 13.0.11, 13.1.8, or 13.2.4). Disable the experimental provisioning feature toggle if enabled. Review and restrict permissions for Git Sync connections to prevent unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-15577. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70